Cardiac Monitor Maker iRhythm Reports Data Breach Affecting Hundreds of Thousands of Patients
iRhythm, the maker of the Zio Patch sensor worn on the chest for continuous heart monitoring, disclosed in filings this week that hackers accessed third-party business systems in June and downloaded the personal and medical data of at least 360,000 patients. The attackers used social engineering to enter the systems and demanded payment in exchange for not publishing the data. Device functionality and clinical systems were not affected. iRhythm said it has no evidence the stolen information has been used to commit identity theft.
Incident timeline and access method
The unauthorized access occurred between June 3 and June 8, according to an iRhythm investigation. Hackers compromised third-party-hosted business applications through a social engineering attack. iRhythm detected the intrusion on June 8 and was contacted by an attacker who claimed to hold sensitive data, including proprietary business records, protected health information and other personal details belonging to patients.
Ransom demand and no public claim
In a June filing with the Securities and Exchange Commission, iRhythm stated that the attacker demanded payment in exchange for not publicly disclosing the stolen information. The company confirmed that certain data was taken from the third-party applications. No hacking group has publicly claimed responsibility for the attack. iRhythm says it has no evidence that the stolen information has been or will be used to commit identity theft.
Affected individuals and data types
Breach notices filed this week in Texas, South Carolina and California identify 298,647 Texas victims and 69,526 in South Carolina. A company spokesperson declined to provide the full victim count. The stolen information includes names, addresses, phone numbers, patient account numbers, device serial numbers, insurance numbers, dates of service and dates of birth. A spokesperson said iRhythm notified affected individuals and applicable regulators once the scope was verified.
Operations and revenue unaffected
iRhythm stated that the incident did not affect clinical systems, medical devices, manufacturing, distribution or financial performance. The company reported $224.2 million in second-quarter revenue and said there was no loss of service or disruption to operations. A spokesperson said the incident did not affect iRhythm clinical systems or medical devices. The breach was confined to third-party business applications.
Steps to protect your information
Monitor explanation-of-benefits statements for fraudulent claims filed under your insurance number. Watch credit reports for new accounts and be alert to phishing emails referencing your iRhythm device or account. Consider placing a fraud alert with credit bureaus if you receive a notice. Report suspicious activity to your insurance provider and to iRhythm.
- Monitor explanation-of-benefits statements for fraudulent claims
- Watch credit reports for new accounts
- Be alert to phishing emails referencing your iRhythm device
- Consider placing a fraud alert with credit bureaus
- Report suspicious activity to your insurance provider
Medical device sector faces repeated attacks
Medical device companies have experienced dozens of cybersecurity incidents over the last two years. According to the source, cyberattacks on Medtronic, Boston Scientific, Stryker, UFP, Masimo, Surmodics, Artivion and Zoll have resulted in the exposure of sensitive medical data affecting millions and have caused supply chain disruptions.
Questions readers ask
Were iRhythm Zio Patch devices or clinical systems compromised?
No. iRhythm stated that the incident did not affect clinical systems or medical devices, and there was no disruption to operations. The breach was limited to third-party-hosted business applications.
What personal information did the hackers steal from iRhythm?
Names, addresses, phone numbers, iRhythm patient account numbers, device serial numbers, insurance numbers, dates of service and dates of birth.
Has the stolen iRhythm data been used for identity theft?
iRhythm says it has no evidence that the personal information has been or will be used to commit identity theft. No hacking group has publicly claimed the attack.
How many people were affected by the iRhythm breach?
At least 360,000 people were affected. Breach notices identify 298,647 victims in Texas and 69,526 in South Carolina. iRhythm also filed notices in California but declined to state the full victim count.
Did iRhythm pay the ransom demand?
iRhythm disclosed that the threat actor demanded payment in exchange for not publishing the data, but the company has not stated whether it paid the ransom.
Source and reporting limits
Based on reporting by The Record. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.